CVE-2026-85355: CWE-829: Inclusion of Functionality from Untrusted Control Sphere in Microsoft Windows 10 Version 1607

This vulnerability, tracked as CVE-2026-85355 and categorized under CWE-829, exists in the Windows Common Log File System Driver. It allows an authorized attacker with local access to elevate their privileges by exploiting the inclusion of functionality from an untrusted control sphere. The issue affects multiple versions of Windows 10 and some earlier Windows builds. The CVSS 3.1 base score is 7.0, indicating high severity, with attack vector local, high attack complexity, low privileges required, no user interaction, and impacts confidentiality, integrity, and availability. Microsoft has published an official fix for this vulnerability.

An authorized local attacker can exploit this vulnerability to elevate privileges on affected Windows systems, potentially gaining higher-level access than intended. The impact affects confidentiality, integrity, and availability of the system. There are no known exploits in the wild at this time.

An official fix is available from Microsoft. Users and administrators should apply the security updates provided by Microsoft for the affected Windows 10 versions as detailed in the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85355. No additional mitigation steps are indicated beyond applying the official patch.